CVE-2026-49838

GoBGP confederation validation panics on empty AS_PATH attribute

Published Sep 10, 2026 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Description

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

Analysis

Technical impact

GoBGP is an open source Border Gateway Protocol implementation written in Go. Prior to version 4.7.0 the software accepts a zero‑length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer because it accesses the first element of the AS_PATH without bounds checking. This flaw causes a denial of service when a confederation eBGP peer receives a malformed UPDATE with an empty AS_PATH attribute, resulting in a process crash.

Affected Systems

The affected product is osrg:gobgp. All releases older than 4.7.0 are vulnerable; releases 4.7.0 and newer contain the fix.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. The EPSS score is less than 1%, showing a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector involves a remote BGP session where an adversary injects a malformed UPDATE packet containing an empty AS_PATH attribute to a confederation eBGP peer, leading to a crash. The flaw is an unchecked array index access (CWE-125) and unchecked bounds checking (CWE-129).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

osrg

gobgp

affected

Version	Status	Constraints
`< 4.7.0`	affected	—

No data.

Vendor Product Versions

Osrg

Gobgp

Version	Status	Scheme	Platform
`[0,4.7.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade GoBGP to version 4.7.0 or later.
If an upgrade is not immediately possible, configure eBGP peers or use BGP policy filtering to discard UPDATE messages that contain an empty AS_PATH attribute before they reach the GoBGP process.
Apply firewall or access‑control rules to block or drop malformed BGP UPDATE packets with an empty AS_PATH from untrusted peers.

Generated by OpenCVE AI on September 21, 2026 at 05:56 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-frrj-87jh-2772	GoBGP confederation validation panics on empty AS_PATH attribute

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.412% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/osrg/gobgp/commit/4a319a6c25630fb3cdbda3e9ccfe56e702bdaaa0
https://github.com/osrg/gobgp/security/advisories/GHSA-frrj-87jh-2772
https://nvd.nist.gov/vuln/detail/CVE-2026-49838
https://www.cve.org/CVERecord?id=CVE-2026-49838

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-49838 https://www.cve.org/CVERecord?id=CVE-2026-49838
Metrics	threat_severity `None`	threat_severity `Moderate`

Sep 11, 2026 11:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 7:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Osrg Osrg gobgp
Vendors & Products		Osrg Osrg gobgp

Sep 10, 2026 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Title		GoBGP confederation validation panics on empty AS_PATH attribute
Weaknesses		CWE-129
References		https://github.com/osrg/gobgp/commit/4a319a6c25630fb3cdbda3e9ccfe56e702bdaaa0 https://github.com/osrg/gobgp/security/advisories/GHSA-frrj-87jh-2772
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`